Hipaa Laws: Do They Apply To Special Education?

Special education schools are educational institutions that cater to students with disabilities or special educational needs. These schools provide tailored educational programs and support services to students with various physical, cognitive, emotional, or developmental challenges. Generally, HIPAA does not apply to elementary or secondary schools because the school is either not a HIPAA-covered entity or maintains health information only on students in records that are education records under FERPA and therefore not subject to the HIPAA Privacy Rule. However, there are exceptions where special education schools may be subject to HIPAA regulations. For example, if a special education school operates a healthcare clinic or provides healthcare services within its facilities, it may collect protected health information (PHI) and thus may be subject to HIPAA.

Special education schools are not considered HIPAA-covered entities

Special education schools are educational institutions that cater to students with disabilities or special educational needs. They provide tailored educational programs and support services to students with various physical, cognitive, emotional, or developmental challenges. While special education schools may collect protected health information (PHI) to provide healthcare services or support to students with disabilities, they are generally not considered HIPAA-covered entities and are not subject to HIPAA regulations.

HIPAA, or the Health Insurance Portability and Accountability Act of 1996, covers individuals and organizations that are considered Covered Entities. Covered Entities include health plans, clearinghouses, and certain healthcare providers. Special education schools typically do not fall into these categories and, therefore, are not subject to HIPAA regulations.

The privacy of student records, including health information, in educational settings, is primarily governed by the Family Educational Rights and Privacy Act (FERPA), not HIPAA. FERPA is a federal law in the United States that protects the privacy of student education records, including health records maintained by educational institutions. It gives students and their parents or guardians the right to access, inspect, and review these records, and to request corrections or amendments. FERPA applies to educational agencies and institutions that receive federal funding, including public schools, school districts, and most postsecondary institutions.

However, there are exceptions where HIPAA regulations may apply to special education schools. If a special education school operates a healthcare clinic or provides healthcare services within its facilities, it may be considered a HIPAA-covered entity. In such cases, the school would need to comply with HIPAA regulations for electronic transactions and code requirements. Additionally, if a school provides healthcare services to employees or other non-students, that data is likely protected by HIPAA.

It is important to note that while special education schools are not subject to HIPAA regulations in most cases, they still have a responsibility to protect the privacy and security of student records, including health information. This is ensured through compliance with FERPA and other applicable laws and regulations.

Special education schools may collect PHI to provide healthcare services

Special education schools may collect protected health information (PHI) to provide healthcare services or support to students with disabilities. This is dependent on the nature of the service, privacy laws, and student consent.

Healthcare services

If a special needs school operates a healthcare clinic or provides healthcare services within its facilities, it may collect PHI. In such cases, the school may be subject to HIPAA.

Informed consent

Special education schools should obtain informed consent from students' parents or guardians before collecting and using PHI.

Individualized education plans (IEPs)

When developing IEPs for students with disabilities, special education schools may collect health-related information to tailor educational and support services to the student's needs.

Privacy laws

The privacy of student records, including health information, in educational settings is primarily governed by the Family Educational Rights and Privacy Act (FERPA), not HIPAA. Under FERPA, health records maintained by educational institutions, including special education schools, are considered "education records." FERPA protects the privacy and security of these records and specifies who can access them and under what conditions.

Annual notification

Schools must provide annual notification to students and their parents or guardians about their rights under FERPA and the school's policies and procedures regarding education records.

Informed consent is required from parents or guardians

In the United States, parental consent is a crucial legal requirement for special education, ensuring compliance with the law and resolving disputes between parents and school districts. Informed consent is required from parents or guardians before a school can take certain actions involving their child. This protects parental rights, promotes transparency, collaboration, and respect, and is essential for protecting children's educational rights and well-being. It also supports customized education and builds supportive collaboration between families and schools.

According to the Individuals with Disabilities Education Act (IDEA), informed consent has three key requirements:

• Full Information about the Proposed Action: Parents must be provided with thorough and clear information about any planned action relating to their child's special education. This includes details concerning tests, services, placement choices, or revisions to the Individualized Education Plan (IEP). Parents should be informed about the goals, advantages, potential hazards, and accessible alternatives so that they can make informed decisions about their child's education.
• Written Agreement from the Parent: To offer informed consent, parents must typically provide written approval or authorization for the requested action. This implies that parents have received and comprehended the information presented and agree to carry out the activity. The written consent acts as a legal record of the agreement between the parents and the school.
• Understanding that Consent is Voluntary and Can Be Withdrawn: Parents must realize that their consent is fully optional and can be revoked at any time without repercussions. The IDEA highlights the freedom of parents to deny permission or change their minds about a planned activity. They should feel empowered to make decisions in their child's best interests without fear of reprisal or harm to their child's educational services.

There are specific situations where parental consent is required under the IDEA:

• Initial Evaluation or Revaluation: Parental approval is necessary before a school can conduct an initial evaluation to determine if a child qualifies for special education services, or before a revaluation to review a child's eligibility or need for services.
• Provision of Services through an Individualized Education Plan (IEP): Before implementing the services and accommodations stated in a child's IEP, parental approval is required. This permission indicates that parents agree with the precise educational plan designed to meet their child's requirements.
• Involving Non-School Agencies in Transition Planning IEP Meetings: Parental consent is essential for involving non-school agencies in Transition Planning IEP Meetings. This ensures that parents are aware of and agree to the participation of these agencies, which can help prepare students with disabilities for post-school life, enhance their transition to adulthood and independence, and connect them with valuable resources.

It is important to note that schools must make sure that parents are given information about their legal rights and that informed consent is obtained before taking any actions involving their child's education. Parents have the right to refuse to give consent, ask for due process, or file a state complaint if they believe their rights have been violated.

Student health information is considered an education record under FERPA

Generally, the HIPAA Privacy Rule does not apply to elementary or secondary schools. This is because, in most cases, schools are not considered HIPAA covered entities. However, there are instances where a school may be a HIPAA covered entity, such as when it employs a healthcare provider that conducts covered transactions electronically, like electronically transmitting health care claims to a health plan for payment. Even in these cases, many schools are not required to comply with the HIPAA Privacy Rule because student health information is maintained in student health records that are considered "education records" under FERPA.

The Family Educational Rights and Privacy Act (FERPA) is a federal law in the United States that protects the privacy of student education records. FERPA defines "education records" as records that are directly related to a student and maintained by an educational agency, institution, or a party acting on their behalf. This includes health records at the K-12 level. FERPA gives students and their parents or guardians the right to access, review, and request corrections to these records. It also allows them to control the disclosure of the records, requiring schools to obtain written consent before releasing them to third parties.

The privacy of student records, including health information, in educational settings, is primarily governed by FERPA, not HIPAA. This means that student health information in education records is protected by FERPA and is excluded from the coverage of the HIPAA Privacy Rule. FERPA applies to educational agencies and institutions that receive funding from programs administered by the U.S. Department of Education, including public schools, school districts, and most private and public postsecondary institutions.

It is important to note that there are exceptions to the application of FERPA and HIPAA. For example, if a school provides health care services to students through its health clinic, it is considered a "health care provider" under HIPAA. If the school also conducts covered transactions electronically in connection with that health care, it is a covered entity and must comply with HIPAA. Additionally, if a school is a HIPAA-covered entity and provides health-related services to non-students, the PHI of non-student patients is subject to HIPAA, not FERPA.

FERPA gives parents the right to access, inspect and review their child's records

Generally, HIPAA does not apply to elementary or secondary schools, including special education schools, because they are not considered HIPAA covered entities. However, special education schools may collect protected health information (PHI) to provide healthcare services or support to students with disabilities. In such cases, the school may be subject to HIPAA regulations.

Now, let's focus on the rights FERPA grants to parents regarding their child's records:

FERPA, or the Family Educational Rights and Privacy Act, gives parents the right to access, inspect, and review their child's educational records. This includes the right to receive an explanation or interpretation of those records. Schools must provide parents with the opportunity to inspect and review their child's records within 45 days of receiving a request. Additionally, FERPA allows parents to request corrections or amendments to the records if they believe they are inaccurate or misleading. If the school denies the request, parents have the right to a formal hearing to review the decision.

FERPA also gives parents control over the disclosure of their child's records. Schools are generally required to obtain written consent from parents before releasing records to third parties. However, there are some exceptions where records may be released without parental consent, such as to school officials with a legitimate educational interest, to other schools during a transfer, or in health and safety emergencies.

It is important to note that FERPA applies to educational agencies and institutions that receive federal funding, including public schools, school districts, and most postsecondary institutions. Private schools that do not receive federal funding are not subject to FERPA.

Frequently asked questions